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EXECUTIVE SUMMARY

   BACKGROUND

        The Freedom of Information Act (FOIA) is a Federal law that provides any
        person the right to submit a written request for access to records or
        information maintained by the Federal Government. The Nuclear
        Regulatory Commission’s (NRC) FOIA program is managed by the FOIA,
        Privacy, and Information Collections Branch (referred to in this report as
        the FOIA office) within the Office of Information Services, Customer
        Service Division.

        The FOIA process begins when the agency (1) receives – via mail,
        facsimile, or Internet – an incoming FOIA request, (2) assigns it a number,
        and (3) determines which NRC offices need to review their records to
        identify whether they have information pertinent to the request and sends
        a request to those offices. FOIA coordinators in responsive offices
        provide an estimate of the search, review, and duplication effort required
        to produce any documents identified as within the scope of the request.

        The FOIA office then estimates the associated processing fees (for which
        the requester may be responsible), advises the requester as to the
        amount due, and assigns the request to the appropriate offices to identify
        and provide to the FOIA office all relevant documents from their office
        within an assigned timeframe. To facilitate appropriate disclosure of
        records, the FOIA coordinators consult as needed with agency staff in the
        responding offices and/or the Office of the General Counsel to prepare a
        response. The response is reviewed and signed by the FOIA officer, and
        sent to the requester.

   OBJECTIVE

        The audit objective was to determine whether the FOIA process is efficient
        and complies with the current laws.

   RESULTS IN BRIEF

        NRC generally responds to FOIA requests in accordance with Federal
        requirements. The agency meets the timeliness requirements for simple
        FOIA requests and adheres to the vast majority of FOIA regulations;
        however, opportunities exist to improve program efficiency and increase
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    Federal compliance by (A) fully using technology and enhancing training
    requirements and (B) adhering to review and approval regulations.

    Operational Efficiency Could Be Improved

    The efficiency of NRC’s FOIA program can be improved by fully using
    available technology and enhancing agency training. Federal agencies
    should have the necessary tools and training to respond promptly and
    efficiently to FOIA requests. However, NRC management has not
    implemented effective internal controls. As a result, FOIA processing
    costs are high and the timeliness requirements are not consistently met.

    Management Level Reviews Are Inconsistent

    NRC is not in compliance with FOIA regulations as initial disclosure
    reviews of FOIA records are done at inconsistent management levels.
    Federal regulations state that, during the initial disclosure review, the head
    of the responsible office must review agency records to determine whether
    the agency records are exempt from disclosure; however, there is no
    enforcement of this policy and there is no method to track these reviews.
    Additionally, NRC’s internal guidance differs from the Code of Federal
    Regulations. This may result in (A) a reduced number of discretionary
    releases or (B) the inadvertent release of sensitive information.

RECOMMENDATIONS

    This report makes nine recommendations to improve the efficiency of
    NRC’s FOIA process.

AGENCY COMMENTS

    An exit conference was held with the agency on June 11, 2014. Prior to
    this meeting, after reviewing a discussion draft, agency management
    provided supplemental information that has been incorporated into this
    report, as appropriate. As a result, agency management stated their
    general agreement with the findings and recommendations in this report
    and opted not to provide formal comments for inclusion in this report.
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ABBREVIATIONS AND ACRONYMS



   ADAMS   Agencywide Documents Access and Management System

   CFR     Code of Federal Regulations

   DOJ     The Department of Justice’s Office of Information Policy

   FOIA    The Freedom of Information Act

   NRC     Nuclear Regulatory Commission

   OIG     Office of the Inspector General

   OIS     Office of Information Services

   TABS    Transforming Assets into Business Solutions
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I.        BACKGROUND

                   The Freedom of Information Act (FOIA)1 is a Federal law that provides any
                   person the right to submit a written request for access to records or
                   information maintained by the Federal Government. In response to such
                   written requests, Federal agencies must disclose the requested records,
                   unless they are protected from release under one of the nine FOIA
                   statutory exemptions. 2 FOIA mandates that all agencies shall readily
                   promulgate information, agency rules, opinions, orders, records, and
                   proceedings to the public.

                   Executive Memoranda

                   In 2009, President Barack Obama and Attorney General Eric Holder
                   issued memoranda on the FOIA. These statements of FOIA policy
                   emphasized that the FOIA "should be administered with a clear
                   presumption: in the face of doubt, openness prevails." The President also
                   directed agencies to "take affirmative steps to make information public"
                   and not to "wait for specific requests from the public." The Attorney
                   General's FOIA Guidelines stressed the need for agencies to:

                       •   Have efficient and effective systems in place for responding to
                           requests.
                       •   Increase proactive disclosures.
                       •   Improve the use of technology.
                       •   Reduce backlogs of pending FOIA requests and appeals.
                       •   Improve timeliness in responding to requests.

                   Federal FOIA Oversight

                   The Department of Justice’s Office of Information Policy (hereinafter
                   referred to as DOJ) oversees agencies’ FOIA implementation.
                   Additionally, DOJ also issues FOIA policy guidance, conducts FOIA-
                   related training programs to Government staff, and is responsible for
                   encouraging compliance.

1
    5 U.S.C. § 552, As Amended
2
    See Appendix B for a listing of the nine statutory exemptions.
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                  NRC Guidance

                  The Nuclear Regulatory Commission’s (NRC) FOIA requirements are
                  conveyed in the Code of Federal Regulations (CFR) under Title 10, Part 9,
                  Subpart A, “Freedom of Information Act Regulations.” NRC Management
                  Directive and Handbook 3.1, “Freedom of Information Act,” provides
                  guidance on NRC’s FOIA policy and implementation of the FOIA process. 3
                  NRC also maintains an internal and public Web site with FOIA information
                  available to staff.

                  FOIA Process

                  NRC’s FOIA program is managed by the FOIA, Privacy, and Information
                  Collections Branch (referred to in this report as the FOIA office 4) within the
                  Office of Information Services (OIS), Customer Service Division. The
                  FOIA process begins when the agency (1) receives – via mail, facsimile,
                  or Internet – an incoming FOIA request, (2) assigns it a number, and (3)
                  determines which NRC offices need to review their records to identify
                  whether they have information pertinent to the request and sends a
                  request to those offices. FOIA coordinators5 in responsive offices provide
                  an estimate of the search, review, and duplication effort required to
                  produce any documents identified as within the scope of the request.

                  The FOIA office then estimates the associated processing fees (for which
                  the requester may be responsible), advises the requester as to the
                  amount due, and assigns the request to the appropriate offices to identify
                  and provide to the FOIA office all relevant documents from their office
                  within an assigned timeframe. To facilitate appropriate disclosure of
                  records, the FOIA coordinators consult as needed with agency staff in the
                  responding offices and/or the Office of the General Counsel to prepare a
                  response. The response is reviewed and signed by the FOIA officer, and

3
    Management Directive 3.1 was last revised on June 8, 2011.
4
  The FOIA office consists of a branch chief, FOIA officer, administrative assistant, and Government
information specialists (also known as FOIA specialists). FOIA specialists consist of NRC employees and
contractors.
5
 Each NRC office has a FOIA coordinator who acts as a central point of contact for his/her respective
office. The coordinator serves as a liaison between the FOIA office and the subject matter experts who
are responsible for collecting and redacting, as appropriate, the FOIA records within the program offices.
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sent to the requester. See Figure 1 for a simplified FOIA process
flowchart.


Figure 1: FOIA Process Flowchart




Source: Office of the Inspector General (OIG)

Agencies have a statutory responsibility to make a determination on FOIA
requests within 20 working days. This type of FOIA request is known as a
“simple” request. The FOIA also gives agencies the right to extend that
time by 10 working days when a given request requires additional search
time or consideration. These types of requests are called “complex”
requests. This may apply when (1) NRC needs to assemble responsive
records from its regional offices; (2) the request involves a "voluminous"
amount of records that must be located, compiled, and reviewed; or (3)
NRC must consult with another NRC office or Federal agency that may
have originated the information or have a substantial interest in the
information.

Japan FOIA Team

Also working on FOIA responses since June of 2011 is a temporary
“Japan team.” The Japan team was created by the Office of Nuclear
Security and Incident Response and OIS for the sole purpose of
responding to the numerous requests for agency records related to the
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                March 2011 Fukushima Daiichi nuclear disaster. 6 Established shortly after
                the Fukushima incident, the Japan team has posted almost 260,000
                pages of responsive records to the agency’s Web site, and has completed
                its review of the last responsive documents. The team anticipates closing
                out all the requests by the end of June 2014. Once the responses are
                completed, the members of the team will either be reassigned or released.
                For these reasons, the Japan team was excluded from the scope of this
                audit.

                FOIA Centralization

                As part of the NRC Transforming Assets into Business Solutions (TABS) 7
                initiative, NRC intends to streamline the FOIA process by eliminating the
                current FOIA coordinator positions within the program offices. 8
                Centralization will move most program office FOIA-related administrative
                functions to the FOIA branch within OIS. Currently, the majority of
                program offices have a FOIA coordinator who is an employee of that office
                and fulfills the coordinator responsibilities as a collateral duty.
                Centralization will transfer these responsibilities to the FOIA office, which
                will add four additional staff to enable it to handle the added workload.
                Centralization is expected to be completed in FY 2015.




6
 On March 11, 2011, a 9.0-magnitude earthquake and an estimated 45-foot-high tsunami struck Japan
off the Honshu Island coast at the Fukushima Daiichi nuclear power plant, causing a hydrogen explosion
and release of radioactive material. Radioactive contamination spread over a large area of Japan,
requiring the relocation of tens of thousands of people.
7
 TABS is an agencywide initiative to reduce the duplication of efforts in corporate support and office
support areas such as human resources, information technology, financial management, and contract
management. The goal of TABS is to reduce agency overhead by finding solutions for the most effective
and efficient delivery of business support services.
8
 The Office of Enforcement, Office of the Secretary, Office of Investigations, regional offices, and OIG
are currently excluded from centralization because of functional and logistical impediments.
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II.    OBJECTIVE

             The audit objective was to determine whether the FOIA process is efficient
             and complies with the current laws. Report Appendix A contains
             information on the audit scope and methodology.


III.   FINDINGS

             NRC generally responds to FOIA requests in accordance with Federal
             requirements. The agency meets the timeliness requirements for simple
             FOIA requests and adheres to the vast majority of FOIA regulations;
             however, opportunities exist to improve program efficiency and increase
             federal compliance by (A) fully using technology and enhancing training
             requirements and (B) adhering to review and approval regulations.

       A. Operational Efficiency Could Be Improved

             The efficiency of NRC’s FOIA program can be improved by fully using
             available technology and enhancing agency training. Federal agencies
             should have the necessary tools and training to respond promptly and
             efficiently to FOIA requests. However, NRC management has not
             implemented effective internal controls. As a result, FOIA processing
             costs are high and the timeliness requirements are not consistently met.

             Processes Should Be Efficient

             Federal agencies, to include NRC, should have the necessary tools and
             training to respond promptly and efficiently to FOIA requests. FOIA
             professionals deserve the full support of the agency's Chief FOIA Officer
             to ensure that they have the tools they need to respond promptly and
             efficiently to FOIA requests. Additionally, all agencies should use modern
             technology to inform citizens about what is known and done by their
             Government. DOJ guidance and best practices suggest that agencies
             should actively explore using technology to process FOIA requests.




                                           5
                                                            Audit of NRC’s Freedom of Information Act Process



                The Open Government National Action Plan for the United States of
                America 9 recommends that all agency employees, not just FOIA
                personnel, have FOIA training in order to efficiently and effectively
                respond to FOIA requests. DOJ guidance and best practices maintains
                that each agency should require that its personnel, both FOIA and non-
                FOIA, attend training to understand FOIA guidelines on transparency.

                Processes Could Be More Efficient

                Use of Technology Could Be Expanded

                NRC does not use technology to the fullest extent possible in processing
                its FOIA requests. The individuals in the program office responsible for
                searching for the requested information (also known as the subject matter
                experts) must provide the records to the FOIA office which, in turn,
                supplies the records to the requester. In many of these instances, when
                the subject matter experts locate the requested records, they must first
                redact any information that falls under one of the statutory exemptions. 10
                For example, any records containing personally identifiable information or
                classified information would either be completely withheld or provided to
                the requester with redactions protecting the sensitive information.

                The entire redaction process is tedious and paper intensive. If subject
                matter experts need to redact any information, they must first make sure
                they print the responsive records as this process is currently done
                manually. They must then manually place “brackets” around the
                information they wish to redact before forwarding the records to the FOIA
                office. The FOIA office staff must then scan the hardcopies into their
                computers before completing the actual redaction using specialized
                software. For a large FOIA request, there could be hundreds or
                thousands of pages to redact.




9
 This plan, created by the Obama administration in 2011 and updated in 2013, lists a set of commitments
and actions that have or will be taken by the Federal Government to create a more efficient, effective, and
accountable Government.
10
  The statutory exemptions can be found in Appendix B. Additionally, in order to withhold information in
agency records, a foreseeable harm statement must be provided for Exemptions 2 and 5.
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Several staff expressed frustration with this manual process. For
example:

   •   The previous NRC FOIA officer and two FOIA coordinators stated
       that reviewing FOIA records is “very time-consuming.”

   •   A contractor hired to process FOIA requests observed that the NRC
       FOIA process was still very “paper-laden” and opined that it should
       move to the electronic world.

   •   A FOIA coordinator from a regional office said that he wanted
       electronic processing because his office has so much paperwork
       even though many of their records are already electronic; this is
       due to the need to print their FOIA records for NRC headquarters.

   •   A FOIA staffer said that rather than dealing with paper and
       microfilm, storing and processing everything electronically would be
       the most efficient way to go.

A senior manager from DOJ stated that electronic processing really cuts
down the manual processing time. The manager added that technology is
the primary way to improve timeliness and that agencies need to go in the
direction of processing FOIA requests electronically.

FOIAXpress

To process FOIA requests more efficiently, the FOIA office uses a
commercial software application called FOIAXpress. FOIAXpress is a tool
used for automating the FOIA request process by managing the entire
lifecycle of a FOIA request, from initial request to final delivery of
documents. The purpose of the software is to automate the FOIA request
process in order to save Federal agencies time and money, while also
ensuring compliance with DOJ requirements. However, as of March 28,
2014, NRC’s FOIA office was using a version of FOIAXpress that was
more than 2 years old (Version 7); the most current version is Version 9.
This is significant for the following reasons:
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                Working with outdated software decreases efficiency and increases the
                likelihood of errors in processing FOIA requests.

                1.       Version 9 of FOIAXpress introduced a feature called Advanced
                         Document Review. Advanced Document Review is a
                         deduplication 11 technology that can significantly reduce email and
                         document sets by filtering out duplicate and non-responsive emails
                         and documents. This, in theory, saves valuable time and effort in
                         redacting the FOIA records.

                According to the DOJ Open Government Plan 2.0, one of the most
                common delays in the processing of FOIA requests across the
                Government is the time spent by FOIA personnel searching for,
                deduplicating, and conducting initial responsiveness reviews on records.
                Much of this is done by hand or by using commercial software with limited
                capabilities for advanced document review and redaction. These steps
                must take place before a FOIA professional can even begin to review
                records for the application of FOIA exemptions and for ultimate release to
                FOIA requesters.

                2.       As a free add-on feature to Version 9 of FOIAXpress, there is an
                         additional tool called Public Access Link. Public Access Link is a
                         public-facing Web portal that provides electronic communication
                         between requesters and Federal agencies. Public Access Link
                         allows requesters to electronically submit FOIA requests,
                         correspond with NRC, check the status of a request, receive their
                         final documents, and access a number of dashboard presentations
                         on NRC’s overall FOIA status – such as the number of open
                         requests or number of requests received.

                To ensure that additional costs were not the primary deterrent to
                upgrading the software, OIG reviewed the FOIAXpress contract and noted
                that NRC purchased the annual maintenance support package. This
                annual support includes software version upgrades of FOIAXpress at no
                additional cost.


11
  Deduplication eliminates extra copies of data by saving just one copy and replacing the other copies
with pointers that lead back to the original copy. In its simplest form, deduplication eliminates duplicate
copies of the same file.
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                Available Technology

                In addition to FOIAXpress, there are other technologies available to assist
                with FOIA processing. According to DOJ FOIA best practices, a key
                aspect of FOIA processing involves searching for records within the
                agency. These searches frequently entail searching through voluminous
                numbers of email messages and disparate records systems throughout
                the organization. Achieving real efficiency in FOIA processing will entail
                agencies maximizing their electronic recordkeeping capacities to facilitate
                identification of the location of records responsive to requests.

                Positive Steps

                While NRC could improve its use of technology to process FOIA requests,
                the agency is doing several things well and has taken steps to increase its
                electronic presence. For example:

                    •   OIS is in the process of providing regions and certain program
                        offices copies of RedactXpress, 12 a software program which would
                        allow subject matter experts to redact documents electronically
                        rather than manually.

                    •   NRC offers an extensive array of informational resources on its
                        public Web site, including its FOIA Web page.

                    •   In addition to its Web site, NRC proactively posts thousands of
                        records in its publicly available electronic recordkeeping system
                        (ADAMS), 13 including records regarding the Fukushima disaster,
                        investigation and enforcement actions, reactor regulation, nuclear
                        material safety, licensing, environmental safety, nuclear security,
                        nuclear research, and agency financial accountability.




12
  RedactXpress is a standalone redaction and declassification software tool used to permanently remove
sensitive information from electronic documents. It eliminates the manual labor of making copies, tracking
documents, and filing.
13
     Agencywide Documents Access and Management System.
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FOIA Training Can Be Improved

The FOIA training at NRC could be improved. While there is a basic
online training course and some occasional agencywide live training
sessions, there are currently no FOIA training requirements for FOIA
specialists, FOIA coordinators, or agency staff in general. Many of the
FOIA specialists and FOIA coordinators claimed that their training was
essentially “on-the-job.”

Several NRC staff expressed frustration with the lack of training for some
of the FOIA specialists. Some of the issues include:

   •   FOIA requests are often far too broad in scope, requiring FOIA
       coordinators to search for “any and all” related to a FOIA request.
       Several coordinators feel that the FOIA office does not do a
       sufficient job of calling requesters and narrowing the scope of their
       requests.

   •   Lack of knowledge regarding NRC’s processes and program
       offices.

   •   Lack of knowledge regarding FOIA law.

Further, as a possible indicator of a lack of training for NRC staff and FOIA
coordinators, two external stakeholders who have frequently submitted
NRC FOIA requests have also been frustrated with certain aspects of
NRC’s FOIA process. Particularly, they were troubled by the inconsistent
redactions produced by NRC.

For example, one stakeholder claimed that certain information may be
redacted in one document of a FOIA request, but the same information will
appear unredacted in another document of a separate FOIA request. The
stakeholder questioned why something would be redacted in one
document but not in another document. He also claimed that he requests
certain documents on a regular basis and, most times, the documents
come back with little or no redactions. Yet, the information is never
publicly posted and he must go through the FOIA process each time for
future requests.
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Likewise, the other stakeholder had a similar complaint regarding NRC’s
“nonsensical redactions.” He believes NRC is inconsistent with its use of
security designations to withhold information. He has submitted FOIA
requests for information that was not publicly available, yet the information
was sent to him completely unredacted. In his view, the documents
should have been redacted or they should have already been publicly
available. NRC's Chief FOIA Officer confirmed that his biggest challenge
was ensuring that NRC provides a consistent response to FOIA requests.

The lack of specific training requirements for NRC FOIA personnel is
noteworthy for several reasons:

1.     The FOIA office has recently experienced a high amount of
       turnover, losing some seasoned personnel with many years of
       experience.

2.     With the impending FOIA centralization and FOIA coordinator roles
       moving to OIS, the new point-of-contact for each program office will
       likely be the office technical assistant. In NRC’s current FOIA
       program, technical assistants typically play little or no role in the
       FOIA process.

3.     FOIA coordinators currently service their own office. After
       centralization, coordinators will be servicing multiple offices, some
       of which they will have little familiarity with.

4.     According to the FOIA.gov public Web site, approximately 74
       percent of NRC’s FOIA requests are considered to be complex
       requests, compared to 33 percent for all other Federal agencies.
       Complex requests involve more documents and coordination with
       multiple NRC offices and/or other Federal agencies.

Lack of Effective Controls

NRC has not fully used technology or created a training program because
NRC management has not implemented effective internal controls.
Specifically, there has been a lack of oversight and communication with
regard to technology issues, and there is no clear written guidance or
policy on training.
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Lack of Oversight and Communication Regarding FOIAXpress

FOIAXpress has not been upgraded to its current version due to a lack of
management oversight and communication. The initial upgrade request
from Version 7 to Version 8 was sent to OIS by the FOIA office on June
25, 2013, yet the actual upgrade did not occur until March 28, 2014. The
primary issue that stalled the upgrade was a technical problem in getting
Version 8 to work with one of NRC’s existing servers. When FOIA office
staff were questioned about this, the consensus among the FOIA staff was
that they did not understand the technical aspects of the issue and were
relying on OIS to fix the problem.

OIG followed up on this issue in interviews with several staff and
management in OIS. After interviews with the Deputy Director of OIS and
the Chief Information Officer, FOIAXpress was upgraded to Version 8 –
approximately 9 months after the FOIA office’s initial request. Still,
Version 8 is not the most current version of FOIAXpress.

During the course of these interviews, it became clear that there was no
ownership of the overall process to upgrade the FOIAXpress software.
Most of those interviewed could not answer questions about where the
breakdown was occurring or who was responsible for overseeing it. It was
readily apparent that there was no communication to or from the FOIA
office and OIS senior management, while the situation lingered without
being adequately addressed.

No Written Training Guidance or Program

Currently, there are no formal training requirements for FOIA specialists
and coordinators because there is no written training guidance or training
program. With FOIA centralization soon approaching, the FOIA office has
written a training plan that is currently in draft mode. In the 2014 Chief
FOIA Officer Report to DOJ, NRC asserts it is “expanding existing
substantive FOIA training based on best-practice FOIA procedures, scope
of exemptions and exclusions, and up-to-date legal developments in
tandem with FOIA centralization. This will be required for all FOIA
professionals and available to all program office staff.”



                             12
                                                           Audit of NRC’s Freedom of Information Act Process



                Two NRC training officials were interviewed and they stated that requiring
                all agency staff to take FOIA training would likely be difficult to implement.
                There is also the question of cost-benefit as making training mandatory for
                all NRC staff has a significant cost associated with it. While providing
                FOIA training for all NRC staff would be ideal, it is not practical because of
                budgetary constraints and only underscores the importance of having
                proper training for FOIA office personnel so they can properly guide and
                assist NRC staff.

                Higher Costs and Reduced Timeliness

                NRC has encountered high FOIA processing costs and has not been
                meeting the statutory 30-day limit to process complex FOIA requests. As
                mentioned earlier in the report, approximately 74 percent of NRC’s FOIA
                requests are considered by the agency to be complex. This also is a
                factor in NRC’s high processing costs and lack of timeliness. See Figure
                2 for a breakdown of requests processed. 14

                Figure 2:

                         NRC's FY13 FOIA Requests Processed
                                                 1
                                                               94

                                                                                 Simple
                                                                                 Complex
                                                                                 Expedited

                                       74%
                              275


                Source: OIG

14
   Expedited requests are FOIA requests placed at the front of the processing queue where the requester
clearly demonstrates a compelling need because (1) the failure to obtain requested records on an
expedited basis could reasonably be expected to pose an imminent threat to the life or physical safety of
an individual or (2) with respect to a person primarily engaged in disseminating information, there is an
urgency to inform the public concerning actual or alleged Federal Government activity.
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               NRC’s cost per FOIA request processed is significantly higher than other
               agencies. NRC spent approximately $7,225 per FOIA request processed
               in FY 2013. 15 The average cost per request processed for the other 98
               Federal agencies was about $615. Other agencies subject to FOIA only
               consider approximately 33 percent of the requests received complex. This
               certainly played a significant factor in the disparity between FOIA
               processing costs, but the fact remains that NRC’s cost per request
               processed still is extremely high. 16

               NRC is also not meeting its statutory 30-day timeliness requirement for
               processing complex FOIA requests. (See Figure 3 for NRC average
               processing times.)

               Figure 3:

                                              NRC's FY13 Average Processing Time

                                             90
                                             80
                    Average Number of Days




                                             70
                                             60                                          Simple

                                             50                 82                       All Requests
                                             40                                          Complex
                                             30
                                                           37
                                             20
                                             10      12
                                              0

               Source: OIG




15
  NRC spent approximately $2.67 million in processing 370 FOIA requests. Data for these calculations
was obtained from the FOIA.gov public Web site.
16
   To help offset the imbalance of NRC’s complex requests compared to other Federal agencies; OIG
also analyzed the cost per FOIA request by removing the Japan team’s FOIA requests. While only a
rough estimate, the cost per FOIA request dropped to approximately $5,000 – still a large number in
relation to all other Federal agencies.
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Recommendations:

     OIG recommends that the Executive Director for Operations:

     1.    Implement technology, such as RedactXpress, in the regions and
           larger program offices to more efficiently process FOIA requests.

     2.    Conduct annual reviews to determine the feasibility of upgrading
           technology within OIS to more efficiently process FOIA requests.

     3.    Develop a process to ensure that the FOIA office’s information
           technology needs are met in a timely manner, specifically with
           regard to FOIAXpress updates.

     4.    Develop and implement an OCHCO and DOJ-approved formal
           training and development program for all FOIA office personnel.

     5.    Obtain DOJ FOIA e-learning training modules and encourage all
           agency staff to pursue completion through annual agency
           communications.

     6.    Reintroduce FOIA branch led training for NRC staff on an annual
           basis.

     7.    Conduct a review of FOIA requests to determine if frequently
           requested non-public documents can be proactively placed into
           public ADAMS for future use.
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        B. Management Level Reviews Are Inconsistent

                NRC is not in compliance with FOIA regulations as initial disclosure
                reviews of FOIA records are done at inconsistent management levels.
                Federal regulations state that, during the initial disclosure review, the head
                of the responsible office must review agency records to determine whether
                the agency records are exempt from disclosure; however, there is no
                enforcement of this policy and there is no method to track these reviews.
                Additionally, NRC’s internal guidance differs from the Code of Federal
                Regulations. This may result in (A) a reduced number of discretionary
                releases 17 or (B) the inadvertent release of sensitive information.

                Review and Approval Required

                The Code of Federal Regulations requires that, during the initial disclosure
                review, the head of the responsible office shall review agency records to
                determine whether the agency records are exempt from disclosure. 18 If
                the head of the office determines that, although exempt, the disclosure of
                the agency records will not be contrary to the public interest and will not
                affect the rights of any person, the head of the office may authorize
                disclosure of the agency records.

                Additionally, Attorney General Holder’s memo states:

                         An agency should not withhold information simply because it may
                         do so legally. I strongly encourage agencies to make discretionary
                         disclosures of information. An agency should not withhold records
                         merely because it can demonstrate, as a technical matter, that the
                         records fall within the scope of a FOIA exemption.




17
  A discretionary disclosure, or discretionary release, is the approved release of information that falls
under one of the FOIA exemptions. This information may be released because it poses no perceived
harm to the agency or individuals involved.
18
  10 CFR 9.25(f). However, the Commission, Office of the Secretary, Office of the Inspector General,
and Office of General Counsel are subject to unique disclosure review requirements. See 10 CFR
9.25(g) for specific details.
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NRC Not in Compliance with FOIA Regulations

NRC is not in compliance with FOIA regulations as initial disclosure
reviews are not consistently conducted by office directors. OIG contacted
19 FOIA coordinators from the program offices and 4 coordinators from
the regional offices inquiring about office director review of FOIA records.
While all four of the regions involve senior management at a branch chief
level or above in FOIA records reviews, approximately half of the program
offices surveyed revealed that no senior management reviewed their FOIA
records.

According to FOIA office staff, a cover memo describing the contents of
the FOIA records usually accompanied the records submitted to the FOIA
office. It was common for FOIA coordinators to sign these cover memos
without a signature from their senior management. The staffer said that
the FOIA office will sometimes process FOIA records without any
confirmation that program office senior management reviewed the
records. Furthermore, if the FOIA records were emailed from a program
office to the FOIA office, there may be no cover memo at all. Another
person in the FOIA office stated that, as a practice, office directors rarely
review FOIA responses coming to the FOIA office.

Lack of Internal Controls

NRC’s initial disclosure reviews are inconsistent because there is a lack of
effective controls. For instance:

   •   The use of the current cover memo is not enforced and it does not
       contain an area for senior management signoff.

   •   There is a disconnect between the Code of Federal Regulations
       and NRC’s primary internal FOIA guidance, Management Directive
       3.1.

Management Directive 3.1 states:

       When information that is believed to be exempt from disclosure has
       been identified and bracketed, the director or a management official
       at the Grade 15 level or higher in the responsible office will review
                              17
                                      Audit of NRC’s Freedom of Information Act Process



       the records, or portions thereof, proposed to be withheld and further
       determine whether disclosure of the exempt information will
       adversely affect the public interest or the rights of any person.

However, the Code of Federal Regulations specifies only the office
director; it does not provide the option of a management official at Grade
15 level or higher to conduct the initial disclosure review.

While the four regional offices and roughly half of the program offices
obtained senior management approval of FOIA packages, very few, if any,
received approvals from the office director. The majority of these offices
followed the guidance in Management Directive 3.1, not the Code of
Federal Regulations. Despite the fact that office director review is in the
Code of Federal Regulations, and a more flexible version is in
Management Directive 3.1, neither policy is uniformly enforced by NRC
management.

Potential for Releases

Without senior management initial disclosure review of FOIA records,
there is the potential that (A) discretionary releases may not occur or (B)
sensitive information could be inadvertently released. According to
regulations, agency staff cannot release exemption-qualified information –
this falls directly on the head of the office. Therefore, if the office director
is not reviewing the FOIA record, the likelihood of overriding a subject
matter expert’s withholdings and making a discretionary release would
significantly decrease.

On the other hand, if an office director or senior management official does
not review a FOIA record, there is also the potential that sensitive
information could be released. The FOIA coordinator and FOIA office may
not have the expertise to sufficiently review the entire FOIA record, while
the Office of the General Counsel generally reviews only redactions within
FOIA records. If the subject matter expert elects not to make redactions in
a FOIA record, then that information may be released without any further
scrutiny.
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Recommendations:

OIG recommends that the Executive Director for Operations:

8.    Develop and implement a process to confirm appropriate program
      and regional office management review of FOIA records.

9.    Either revise Management Directive 3.1 to comply with the
      disclosure review requirements found in 10 CFR Part 9.25(f) or
      revise 10 CFR Part 9.25(f) to allow office heads the authority to
      delegate the initial disclosure review determination responsibility to
      a designee at a managerial Grade 15 level or above.
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IV.       CHALLENGES

                  NRC’s upcoming plan to centralize most FOIA coordinator positions into
                  OIS presents several challenges for the agency. During interviews with
                  staff, OIG found there is resistance to the upcoming centralization. FOIA
                  specialists, FOIA coordinators, and an NRC manager all expressed
                  concerns. Many staff interviewed believe that centralization will make the
                  FOIA process less efficient by adding additional unintended steps and
                  removing the expertise from the offices. Some of the concerns expressed
                  to OIG by staff regarding centralization are:

                      •   Centralization will just be “an extra layer to the process.”

                      •   The FOIA process was set up in a decentralized way years ago
                          (i.e., a coordinator in each office) because you want expertise in the
                          office.

                      •   There will be additional back and forth between offices and there
                          could also be individuals in the program offices that have no
                          experience processing FOIA requests.

                  Communication

                  Communication is the most significant challenge associated with
                  centralization. Relevant, reliable, and timely communication is required to
                  control operations and achieve objectives. Recently, OIG found an overall
                  lack of effective communication within OIS during an Audit of NRC’s
                  Information Technology Governance. 19 In light of this finding and staff’s
                  resistance to centralization, management’s involvement and commitment
                  to communication is essential. NRC management must communicate its
                  vision of how a centralized FOIA office will function. In order to achieve
                  buy-in, management should involve as many people as possible,
                  communicate the essentials, and communicate frequently to respond to
                  staff's needs.




19
     This report (OIG-14-A-04) is publicly available in ADAMS; see accession number ML13343A244.
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OIS management confirmed that communication is a challenge and is
taking steps to address this. Management explained that the information
technology coordinator centralization (also part of the agencywide initiative
to reduce duplication of efforts) is going well and that they are applying the
same model towards the FOIA centralization. Focus groups from program
offices have been established to discuss issues with the FOIA process.
Additionally, weekly centralization meetings were held with FOIA staff to
solicit feedback.

Guidance

Ensuring that FOIA guidance documents are up to date is another
challenge associated with centralization. Centralization will cause
processes and procedures to change. Federal standards require clearly
documenting processes at an appropriate level of detail to allow
management to effectively monitor the activity. Guidance must be
properly managed, maintained, and made available in order to meet its
intended purpose. Management must plan to update or revise procedures
with any changes resulting from centralization. Well-designed guidance
documents, if used properly, can appropriately direct agency employees
and increase efficiency.

Monitoring

Another challenge will be to determine if the centralization of FOIA staff is
achieving the desired outcomes. Once centralization is complete,
management should monitor performance measures and indicators to
determine if the new centralized structure is performing as intended. A
best practice would also be to conduct a self-assessment of the FOIA
program after the centralization is complete. Management can then use
the results of these efforts to modify any processes found to have
weaknesses.
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V.   CONSOLIDATED LIST OF RECOMMENDATIONS


         OIG recommends that the Executive Director for Operations:

         1.    Implement technology, such as RedactXpress, in the regions and
               larger program offices to more efficiently process FOIA requests.

         2.    Conduct annual reviews to determine the feasibility of upgrading
               technology within OIS to more efficiently process FOIA requests.

         3.    Develop a process to ensure that the FOIA office’s information
               technology needs are met in a timely manner, specifically with
               regard to FOIAXpress updates.

         4.    Develop and implement an OCHCO and DOJ-approved formal
               training and development program for all FOIA office personnel.

         5.    Obtain DOJ FOIA e-learning training modules and encourage all
               agency staff to pursue completion through annual agency
               communications.

         6.    Reintroduce FOIA branch led training for NRC staff on an annual
               basis.

         7.    Conduct a review of FOIA requests to determine if frequently
               requested non-public documents can be proactively placed into
               public ADAMS for future use.

         8.    Develop and implement a process to confirm appropriate program
               and regional office management review of FOIA records.

         9.    Either revise Management Directive 3.1 to comply with the
               disclosure review requirements found in 10 CFR Part 9.25(f) or
               revise 10 CFR Part 9.25(f) to allow office heads the authority to
               delegate the initial disclosure review determination responsibility to
               a designee at a managerial Grade 15 level or above.
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VI.   AGENCY COMMENTS


         An exit conference was held with the agency on June 11, 2014. Prior to
         this meeting, after reviewing a discussion draft, agency management
         provided supplemental information that has been incorporated into this
         report, as appropriate. As a result, agency management stated their
         general agreement with the findings and recommendations in this report
         and opted not to provide formal comments for inclusion in this report.
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                                                                                     Appendix A


OBJECTIVE, SCOPE, AND METHODOLOGY

    OBJECTIVE

            The audit objective was to determine whether the FOIA process is efficient
            and complies with the current laws.

    SCOPE

            The audit reviewed NRC’s activities related to FOIA with special emphasis
            on process and compliance with current laws. This audit did not review
            FOIA activities associated with the Japan FOIA efforts. OIG conducted
            this performance audit from November 2013 through April 2014 at NRC
            headquarters in Rockville, Maryland. Internal controls related to the audit
            objective were reviewed and analyzed. Throughout the audit, auditors
            were aware of the possibility or existence of fraud, waste, and abuse in
            the program.

    METHODOLOGY

            To address the audit objective, OIG auditors interviewed 65 individuals.
            These interviews included NRC management and staff at headquarters
            and staff at each of NRC’s four regional offices. Regional office interviews
            were conducted by telephone. The interviews also included stakeholders
            and management from the Office of Information Policy at the Department
            of Justice. Furthermore, OIG reviewed Federal and internal agency
            guidance, including:

               •   Freedom of Information Act (5 U.S.C. § 552).

               •   10 CFR Part 9, Subpart A, Freedom of Information Act Regulations.

               •   NRC Management Directive 3.53, NRC Records and Document
                   Management Program.

               •   Executive Order 13392 of December 14, 2005, Improving Agency
                   Disclosure of Information.
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   •   2009 Presidential Memorandum for the Heads of Executive
       Departments and Agencies.

   •   Attorney General Memorandum for the Heads of Executive
       Departments and Agencies.

   •   Second Open Government National Action Plan for the United
       States of America.

OIG auditors observed a walkthrough of the FOIA process and assessed
the technological tools used for FOIA processing. Furthermore, OIG
conducted a review and analysis of FOIA:

   •   Timeliness statistics.
   •   Training requirements.
   •   Processing costs.
   •   Approvals.
   •   Dispositions.
   •   Repetitive requests.

We conducted this performance audit in accordance with generally
accepted Government auditing standards. Those standards require that
we plan and perform the audit to obtain sufficient, appropriate evidence to
provide a reasonable basis for our findings and conclusions based on our
audit objectives. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit
objectives.

The audit was conducted by Beth Serepca, Team Leader;
Robert Woodward, Audit Manager; Michael Blair, Senior Analyst;
Jenny Cheung, Auditor; and Regina Revinzon, Student Analyst.
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                                                                                              Appendix B
FOIA Exemptions

 Exemption   Matters that are exempt from FOIA
  number
    (1)      (A) Specifically authorized under criteria established by an Executive Order to be kept
             secret in the interest of national defense or foreign policy and (B) are in fact properly
             classified pursuant to the Executive Order.
    (2)      Related solely to the internal personnel rules and practices of an agency.
    (3)      Specifically exempted from disclosure by statute (other than section 552b of this title),
             provided that such statute (A) requires that matters be withheld from the public in such
             a manner as to leave no discretion on the issue or (B) establishes particular criteria for
             withholding or refers to particular types of matters to be withheld.
    (4)      Trade secrets and commercial or financial information obtained from a person and
             privileged or confidential.
    (5)      Interagency or intra-agency memorandums or letters that would not be available by
             law to a party other than an agency in litigation with the agency.
    (6)      Personnel and medical files and similar files the disclosure of which would constitute a
             clearly unwarranted invasion of personal privacy.
    (7)      Records or information compiled for law enforcement purposes, but only to the extent
             that the production of such law enforcement records or information:
    (A)      could reasonably be expected to interfere with enforcement proceedings;
    (B)      would deprive a person of a right to a fair trial or impartial adjudication;
    (C)      could reasonably be expected to constitute an unwarranted invasion of personal
             privacy;
    (D)      could reasonably be expected to disclose the identity of a confidential source, including
             a state, local, or foreign agency or authority or any private institution which furnished
             information on a confidential basis, and, in the case of a record or information compiled
             by a criminal law enforcement authority in the course of a criminal investigation or by
             an agency conducting a lawful national security intelligence investigation, information
             furnished by confidential source;
    (E)      would disclose techniques and procedures for law enforcement investigations or
             prosecutions, or would disclose guidelines for law enforcement investigations or
             prosecutions if such disclosure could reasonably be expected to risk circumvention of
             the law; or
    (F)      could reasonably be expected to endanger the life or physical safety of an individual.
    (8)      Contained in or related to examination, operating, or condition of reports prepared by,
             on behalf of, or for the use of an agency responsible for the regulation of supervision of
             financial institutions.
    (9)      Geological and geophysical information and data, including maps, concerning wells.
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